fix mount and browser

debian/changelog

@@ -1,3 +1,10 @@
+refpolicy (2:2.20240723-2deepin4) unstable; urgency=medium
+
+  * fix mount and browser bug.
+  *
+
+ -- xiongyingrong <[email protected]>  Wed, 06 Nov 2024 16:11:11 +0800
+
 refpolicy (2:2.20240723-2deepin3) unstable; urgency=medium
 
   * change to support umount control.                            

debian/patches/0001-deepin-fix-mount-and-browser.patch

@@ -0,0 +1,35 @@
+From 1b845edc2e28da8e3b9dd80816a799b6e0fad037 Mon Sep 17 00:00:00 2001
+From: xyr218 <[email protected]>
+Date: Wed, 6 Nov 2024 16:36:47 +0800
+Subject: [PATCH] deepin fix mount and browser
+
+---
+ policy/modules/services/deepin_perm_control.te | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/policy/modules/services/deepin_perm_control.te b/policy/modules/services/deepin_perm_control.te
+index ec485b7..1153833 100644
+--- a/policy/modules/services/deepin_perm_control.te
++++ b/policy/modules/services/deepin_perm_control.te
+@@ -127,6 +127,7 @@ require {
+ 	class context contains;
+ 	class service all_service_perms;
+ 	class passwd { passwd chfn chsh rootok crontab };
++	class lnk_file read;
+ 	role system_r;
+ 	type sysadm_t;
+ 	type sysadm_sudo_t;
+@@ -865,4 +866,7 @@ require {
+ }
+ type deepin_immutable_t;  
+ deepin_app_domain_set(deepin_immutable_t);
+-allow deepin_immutable_t deepin_ro_file_t:filesystem { unmount };
+\ No newline at end of file
++allow deepin_immutable_t deepin_ro_file_t:filesystem { unmount };
++
++allow deepin_usec_t self:capability2 mac_admin;
++allow deepin_usec_t deepin_app_domain:lnk_file read;
+\ No newline at end of file
+-- 
+2.20.1
+

debian/patches/series

@@ -18,3 +18,4 @@ thunderbolt
 4000-bubblewrap
 support-v25-usec-policy.patch
 0001-deepin-umount-control.patch
+0001-deepin-fix-mount-and-browser.patch